@kilic.dev/pulumi-k8s-crds 4.0.0 → 4.0.2

package/dist/types/input.d.ts

@@ -49747,253 +49747,6 @@ export declare namespace cilium {
              */
             externalCIDRs?: pulumi.Input<pulumi.Input<string>[] | undefined>;
         }
-        interface CiliumClusterwideEnvoyConfig {
-            /**
-             * APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-             */
-            apiVersion?: pulumi.Input<"cilium.io/v2" | undefined>;
-            /**
-             * Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-             */
-            kind?: pulumi.Input<"CiliumClusterwideEnvoyConfig" | undefined>;
-            /**
-             * Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
-             */
-            metadata: pulumi.Input<pulumiKubernetes.types.input.meta.v1.ObjectMeta>;
-            spec?: pulumi.Input<inputs.cilium.v2.CiliumClusterwideEnvoyConfigSpec | undefined>;
-        }
-        interface CiliumClusterwideEnvoyConfigSpec {
-            /**
-             * BackendServices specifies Kubernetes services whose backends
-             * are automatically synced to Envoy using EDS.  Traffic for these
-             * services is not forwarded to an Envoy listener. This allows an
-             * Envoy listener load balance traffic to these backends while
-             * normal Cilium service load balancing takes care of balancing
-             * traffic for these services at the same time.
-             */
-            backendServices?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumClusterwideEnvoyConfigSpecBackendServices>[] | undefined>;
-            nodeSelector?: pulumi.Input<inputs.cilium.v2.CiliumClusterwideEnvoyConfigSpecNodeSelector | undefined>;
-            /**
-             * Envoy xDS resources, a list of the following Envoy resource types:
-             * type.googleapis.com/envoy.config.listener.v3.Listener,
-             * type.googleapis.com/envoy.config.route.v3.RouteConfiguration,
-             * type.googleapis.com/envoy.config.cluster.v3.Cluster,
-             * type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment, and
-             * type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret.
-             */
-            resources: pulumi.Input<pulumi.Input<{
-                [key: string]: any;
-            }>[]>;
-            /**
-             * Services specifies Kubernetes services for which traffic is
-             * forwarded to an Envoy listener for L7 load balancing. Backends
-             * of these services are automatically synced to Envoy usign EDS.
-             */
-            services?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumClusterwideEnvoyConfigSpecServices>[] | undefined>;
-        }
-        interface CiliumClusterwideEnvoyConfigSpecBackendServices {
-            /**
-             * Name is the name of a destination Kubernetes service that identifies traffic
-             * to be redirected.
-             */
-            name: pulumi.Input<string>;
-            /**
-             * Namespace is the Kubernetes service namespace.
-             * In CiliumEnvoyConfig namespace defaults to the namespace of the CEC,
-             * In CiliumClusterwideEnvoyConfig namespace defaults to "default".
-             */
-            namespace?: pulumi.Input<string | undefined>;
-            /**
-             * Ports is a set of port numbers, which can be used for filtering in case of underlying
-             * is exposing multiple port numbers.
-             */
-            number?: pulumi.Input<pulumi.Input<string>[] | undefined>;
-        }
-        interface CiliumClusterwideEnvoyConfigSpecBackendServicesPatch {
-            /**
-             * Name is the name of a destination Kubernetes service that identifies traffic
-             * to be redirected.
-             */
-            name?: pulumi.Input<string | undefined>;
-            /**
-             * Namespace is the Kubernetes service namespace.
-             * In CiliumEnvoyConfig namespace defaults to the namespace of the CEC,
-             * In CiliumClusterwideEnvoyConfig namespace defaults to "default".
-             */
-            namespace?: pulumi.Input<string | undefined>;
-            /**
-             * Ports is a set of port numbers, which can be used for filtering in case of underlying
-             * is exposing multiple port numbers.
-             */
-            number?: pulumi.Input<pulumi.Input<string>[] | undefined>;
-        }
-        /**
-         * NodeSelector is a label selector that determines to which nodes
-         * this configuration applies.
-         * If nil, then this config applies to all nodes.
-         */
-        interface CiliumClusterwideEnvoyConfigSpecNodeSelector {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumClusterwideEnvoyConfigSpecNodeSelectorMatchExpressions>[] | undefined>;
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels?: pulumi.Input<{
-                [key: string]: pulumi.Input<string>;
-            } | undefined>;
-        }
-        /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
-         */
-        interface CiliumClusterwideEnvoyConfigSpecNodeSelectorMatchExpressions {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key: pulumi.Input<string>;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator: pulumi.Input<string>;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values?: pulumi.Input<pulumi.Input<string>[] | undefined>;
-        }
-        /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
-         */
-        interface CiliumClusterwideEnvoyConfigSpecNodeSelectorMatchExpressionsPatch {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key?: pulumi.Input<string | undefined>;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator?: pulumi.Input<string | undefined>;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values?: pulumi.Input<pulumi.Input<string>[] | undefined>;
-        }
-        /**
-         * NodeSelector is a label selector that determines to which nodes
-         * this configuration applies.
-         * If nil, then this config applies to all nodes.
-         */
-        interface CiliumClusterwideEnvoyConfigSpecNodeSelectorPatch {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumClusterwideEnvoyConfigSpecNodeSelectorMatchExpressionsPatch>[] | undefined>;
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels?: pulumi.Input<{
-                [key: string]: pulumi.Input<string>;
-            } | undefined>;
-        }
-        interface CiliumClusterwideEnvoyConfigSpecPatch {
-            /**
-             * BackendServices specifies Kubernetes services whose backends
-             * are automatically synced to Envoy using EDS.  Traffic for these
-             * services is not forwarded to an Envoy listener. This allows an
-             * Envoy listener load balance traffic to these backends while
-             * normal Cilium service load balancing takes care of balancing
-             * traffic for these services at the same time.
-             */
-            backendServices?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumClusterwideEnvoyConfigSpecBackendServicesPatch>[] | undefined>;
-            nodeSelector?: pulumi.Input<inputs.cilium.v2.CiliumClusterwideEnvoyConfigSpecNodeSelectorPatch | undefined>;
-            /**
-             * Envoy xDS resources, a list of the following Envoy resource types:
-             * type.googleapis.com/envoy.config.listener.v3.Listener,
-             * type.googleapis.com/envoy.config.route.v3.RouteConfiguration,
-             * type.googleapis.com/envoy.config.cluster.v3.Cluster,
-             * type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment, and
-             * type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret.
-             */
-            resources?: pulumi.Input<pulumi.Input<{
-                [key: string]: any;
-            }>[] | undefined>;
-            /**
-             * Services specifies Kubernetes services for which traffic is
-             * forwarded to an Envoy listener for L7 load balancing. Backends
-             * of these services are automatically synced to Envoy usign EDS.
-             */
-            services?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumClusterwideEnvoyConfigSpecServicesPatch>[] | undefined>;
-        }
-        interface CiliumClusterwideEnvoyConfigSpecServices {
-            /**
-             * Listener specifies the name of the Envoy listener the
-             * service traffic is redirected to. The listener must be
-             * specified in the Envoy 'resources' of the same
-             * CiliumEnvoyConfig.
-             *
-             * If omitted, the first listener specified in 'resources' is
-             * used.
-             */
-            listener?: pulumi.Input<string | undefined>;
-            /**
-             * Name is the name of a destination Kubernetes service that identifies traffic
-             * to be redirected.
-             */
-            name: pulumi.Input<string>;
-            /**
-             * Namespace is the Kubernetes service namespace.
-             * In CiliumEnvoyConfig namespace this is overridden to the namespace of the CEC,
-             * In CiliumClusterwideEnvoyConfig namespace defaults to "default".
-             */
-            namespace?: pulumi.Input<string | undefined>;
-            /**
-             * Ports is a set of service's frontend ports that should be redirected to the Envoy
-             * listener. By default all frontend ports of the service are redirected.
-             */
-            ports?: pulumi.Input<pulumi.Input<number>[] | undefined>;
-        }
-        interface CiliumClusterwideEnvoyConfigSpecServicesPatch {
-            /**
-             * Listener specifies the name of the Envoy listener the
-             * service traffic is redirected to. The listener must be
-             * specified in the Envoy 'resources' of the same
-             * CiliumEnvoyConfig.
-             *
-             * If omitted, the first listener specified in 'resources' is
-             * used.
-             */
-            listener?: pulumi.Input<string | undefined>;
-            /**
-             * Name is the name of a destination Kubernetes service that identifies traffic
-             * to be redirected.
-             */
-            name?: pulumi.Input<string | undefined>;
-            /**
-             * Namespace is the Kubernetes service namespace.
-             * In CiliumEnvoyConfig namespace this is overridden to the namespace of the CEC,
-             * In CiliumClusterwideEnvoyConfig namespace defaults to "default".
-             */
-            namespace?: pulumi.Input<string | undefined>;
-            /**
-             * Ports is a set of service's frontend ports that should be redirected to the Envoy
-             * listener. By default all frontend ports of the service are redirected.
-             */
-            ports?: pulumi.Input<pulumi.Input<number>[] | undefined>;
-        }
         /**
          * CiliumClusterwideNetworkPolicy is a Kubernetes third-party resource with an
          * modified version of CiliumNetworkPolicy which is cluster scoped rather than
@@ -59804,7 +59557,12 @@ export declare namespace cilium {
              */
             type: pulumi.Input<string>;
         }
-        interface CiliumEgressGatewayPolicy {
+        /**
+         * CiliumLoadBalancerIPPool is a Kubernetes third-party resource which
+         * is used to defined pools of IPs which the operator can use to allocate
+         * and advertise IPs for Services of type LoadBalancer.
+         */
+        interface CiliumLoadBalancerIPPool {
             /**
              * APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
              */
@@ -59812,259 +59570,82 @@ export declare namespace cilium {
             /**
              * Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
              */
-            kind?: pulumi.Input<"CiliumEgressGatewayPolicy" | undefined>;
+            kind?: pulumi.Input<"CiliumLoadBalancerIPPool" | undefined>;
             /**
              * Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
              */
             metadata: pulumi.Input<pulumiKubernetes.types.input.meta.v1.ObjectMeta>;
-            spec?: pulumi.Input<inputs.cilium.v2.CiliumEgressGatewayPolicySpec | undefined>;
-        }
-        interface CiliumEgressGatewayPolicySpec {
-            /**
-             * DestinationCIDRs is a list of destination CIDRs for destination IP addresses.
-             * If a destination IP matches any one CIDR, it will be selected.
-             */
-            destinationCIDRs: pulumi.Input<pulumi.Input<string>[]>;
-            egressGateway: pulumi.Input<inputs.cilium.v2.CiliumEgressGatewayPolicySpecEgressGateway>;
-            /**
-             * Optional list of gateway nodes responsible for SNATing traffic.
-             * If this field has any entries the contents of the egressGateway field will be ignored.
-             * In case multiple nodes are a match for the given set of labels in each entry,
-             * the first node in lexical ordering based on their name will be selected for each entry.
-             */
-            egressGateways?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumEgressGatewayPolicySpecEgressGateways>[] | undefined>;
-            /**
-             * ExcludedCIDRs is a list of destination CIDRs that will be excluded
-             * from the egress gateway redirection and SNAT logic.
-             * Should be a subset of destinationCIDRs otherwise it will not have any
-             * effect.
-             */
-            excludedCIDRs?: pulumi.Input<pulumi.Input<string>[] | undefined>;
-            /**
-             * Egress represents a list of rules by which egress traffic is
-             * filtered from the source pods.
-             */
-            selectors: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumEgressGatewayPolicySpecSelectors>[]>;
-        }
-        /**
-         * EgressGateway is the gateway node responsible for SNATing traffic.
-         * In case multiple nodes are a match for the given set of labels, the first node
-         * in lexical ordering based on their name will be selected.
-         */
-        interface CiliumEgressGatewayPolicySpecEgressGateway {
-            /**
-             * EgressIP is the source IP address that the egress traffic is SNATed
-             * with.
-             *
-             * Example:
-             * When set to "192.168.1.100", matching egress traffic will be
-             * redirected to the node matching the NodeSelector field and SNATed
-             * with IP address 192.168.1.100.
-             *
-             * When set to "2001:db8::1", matching egress traffic will be
-             * redirected to the node matching the NodeSelector field and SNATed
-             * with IPv6 address 2001:db8::1.
-             *
-             * When none of the Interface or EgressIP fields is specified, the
-             * policy will use the first IPv4 assigned to the interface with the
-             * default route.
-             */
-            egressIP?: pulumi.Input<string | undefined>;
-            /**
-             * Interface is the network interface to which the egress IP address
-             * that the traffic is SNATed with is assigned.
-             *
-             * Example:
-             * When set to "eth1", matching egress traffic will be redirected to the
-             * node matching the NodeSelector field and SNATed with the first IPv4
-             * address assigned to the eth1 interface.
-             *
-             * When none of the Interface or EgressIP fields is specified, the
-             * policy will use the first IPv4 assigned to the interface with the
-             * default route.
-             */
-            interface?: pulumi.Input<string | undefined>;
-            nodeSelector: pulumi.Input<inputs.cilium.v2.CiliumEgressGatewayPolicySpecEgressGatewayNodeSelector>;
-        }
-        /**
-         * This is a label selector which selects the node that should act as
-         * egress gateway for the given policy.
-         * In case multiple nodes are selected, only the first one in the
-         * lexical ordering over the node names will be used.
-         * This field follows standard label selector semantics.
-         */
-        interface CiliumEgressGatewayPolicySpecEgressGatewayNodeSelector {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumEgressGatewayPolicySpecEgressGatewayNodeSelectorMatchExpressions>[] | undefined>;
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels?: pulumi.Input<{
-                [key: string]: pulumi.Input<string>;
-            } | undefined>;
+            spec: pulumi.Input<inputs.cilium.v2.CiliumLoadBalancerIPPoolSpec>;
+            status?: pulumi.Input<inputs.cilium.v2.CiliumLoadBalancerIPPoolStatus | undefined>;
         }
         /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
+         * Spec is a human readable description for a BGP load balancer
+         * ip pool.
          */
-        interface CiliumEgressGatewayPolicySpecEgressGatewayNodeSelectorMatchExpressions {
+        interface CiliumLoadBalancerIPPoolSpec {
             /**
-             * key is the label key that the selector applies to.
+             * AllowFirstLastIPs, if set to `Yes` or undefined means that the first and last IPs of each CIDR will be allocatable.
+             * If `No`, these IPs will be reserved. This field is ignored for /{31,32} and /{127,128} CIDRs since
+             * reserving the first and last IPs would make the CIDRs unusable.
              */
-            key: pulumi.Input<string>;
+            allowFirstLastIPs?: pulumi.Input<string | undefined>;
             /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
+             * Blocks is a list of CIDRs comprising this IP Pool
              */
-            operator: pulumi.Input<string>;
+            blocks?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumLoadBalancerIPPoolSpecBlocks>[] | undefined>;
             /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
+             * Disabled, if set to true means that no new IPs will be allocated from this pool.
+             * Existing allocations will not be removed from services.
              */
-            values?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+            disabled?: pulumi.Input<boolean | undefined>;
+            serviceSelector?: pulumi.Input<inputs.cilium.v2.CiliumLoadBalancerIPPoolSpecServiceSelector | undefined>;
         }
         /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
+         * CiliumLoadBalancerIPPoolIPBlock describes a single IP block.
          */
-        interface CiliumEgressGatewayPolicySpecEgressGatewayNodeSelectorMatchExpressionsPatch {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key?: pulumi.Input<string | undefined>;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator?: pulumi.Input<string | undefined>;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+        interface CiliumLoadBalancerIPPoolSpecBlocks {
+            cidr?: pulumi.Input<string | undefined>;
+            start?: pulumi.Input<string | undefined>;
+            stop?: pulumi.Input<string | undefined>;
         }
         /**
-         * This is a label selector which selects the node that should act as
-         * egress gateway for the given policy.
-         * In case multiple nodes are selected, only the first one in the
-         * lexical ordering over the node names will be used.
-         * This field follows standard label selector semantics.
+         * CiliumLoadBalancerIPPoolIPBlock describes a single IP block.
          */
-        interface CiliumEgressGatewayPolicySpecEgressGatewayNodeSelectorPatch {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumEgressGatewayPolicySpecEgressGatewayNodeSelectorMatchExpressionsPatch>[] | undefined>;
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels?: pulumi.Input<{
-                [key: string]: pulumi.Input<string>;
-            } | undefined>;
+        interface CiliumLoadBalancerIPPoolSpecBlocksPatch {
+            cidr?: pulumi.Input<string | undefined>;
+            start?: pulumi.Input<string | undefined>;
+            stop?: pulumi.Input<string | undefined>;
         }
         /**
-         * EgressGateway is the gateway node responsible for SNATing traffic.
-         * In case multiple nodes are a match for the given set of labels, the first node
-         * in lexical ordering based on their name will be selected.
+         * Spec is a human readable description for a BGP load balancer
+         * ip pool.
          */
-        interface CiliumEgressGatewayPolicySpecEgressGatewayPatch {
-            /**
-             * EgressIP is the source IP address that the egress traffic is SNATed
-             * with.
-             *
-             * Example:
-             * When set to "192.168.1.100", matching egress traffic will be
-             * redirected to the node matching the NodeSelector field and SNATed
-             * with IP address 192.168.1.100.
-             *
-             * When set to "2001:db8::1", matching egress traffic will be
-             * redirected to the node matching the NodeSelector field and SNATed
-             * with IPv6 address 2001:db8::1.
-             *
-             * When none of the Interface or EgressIP fields is specified, the
-             * policy will use the first IPv4 assigned to the interface with the
-             * default route.
-             */
-            egressIP?: pulumi.Input<string | undefined>;
+        interface CiliumLoadBalancerIPPoolSpecPatch {
             /**
-             * Interface is the network interface to which the egress IP address
-             * that the traffic is SNATed with is assigned.
-             *
-             * Example:
-             * When set to "eth1", matching egress traffic will be redirected to the
-             * node matching the NodeSelector field and SNATed with the first IPv4
-             * address assigned to the eth1 interface.
-             *
-             * When none of the Interface or EgressIP fields is specified, the
-             * policy will use the first IPv4 assigned to the interface with the
-             * default route.
+             * AllowFirstLastIPs, if set to `Yes` or undefined means that the first and last IPs of each CIDR will be allocatable.
+             * If `No`, these IPs will be reserved. This field is ignored for /{31,32} and /{127,128} CIDRs since
+             * reserving the first and last IPs would make the CIDRs unusable.
              */
-            interface?: pulumi.Input<string | undefined>;
-            nodeSelector?: pulumi.Input<inputs.cilium.v2.CiliumEgressGatewayPolicySpecEgressGatewayNodeSelectorPatch | undefined>;
-        }
-        /**
-         * EgressGateway identifies the node that should act as egress gateway for a
-         * given egress Gateway policy. In addition to that it also specifies the
-         * configuration of said node (which egress IP or network interface should be
-         * used to SNAT traffic).
-         */
-        interface CiliumEgressGatewayPolicySpecEgressGateways {
+            allowFirstLastIPs?: pulumi.Input<string | undefined>;
             /**
-             * EgressIP is the source IP address that the egress traffic is SNATed
-             * with.
-             *
-             * Example:
-             * When set to "192.168.1.100", matching egress traffic will be
-             * redirected to the node matching the NodeSelector field and SNATed
-             * with IP address 192.168.1.100.
-             *
-             * When set to "2001:db8::1", matching egress traffic will be
-             * redirected to the node matching the NodeSelector field and SNATed
-             * with IPv6 address 2001:db8::1.
-             *
-             * When none of the Interface or EgressIP fields is specified, the
-             * policy will use the first IPv4 assigned to the interface with the
-             * default route.
+             * Blocks is a list of CIDRs comprising this IP Pool
              */
-            egressIP?: pulumi.Input<string | undefined>;
+            blocks?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumLoadBalancerIPPoolSpecBlocksPatch>[] | undefined>;
             /**
-             * Interface is the network interface to which the egress IP address
-             * that the traffic is SNATed with is assigned.
-             *
-             * Example:
-             * When set to "eth1", matching egress traffic will be redirected to the
-             * node matching the NodeSelector field and SNATed with the first IPv4
-             * address assigned to the eth1 interface.
-             *
-             * When none of the Interface or EgressIP fields is specified, the
-             * policy will use the first IPv4 assigned to the interface with the
-             * default route.
+             * Disabled, if set to true means that no new IPs will be allocated from this pool.
+             * Existing allocations will not be removed from services.
              */
-            interface?: pulumi.Input<string | undefined>;
-            nodeSelector: pulumi.Input<inputs.cilium.v2.CiliumEgressGatewayPolicySpecEgressGatewaysNodeSelector>;
+            disabled?: pulumi.Input<boolean | undefined>;
+            serviceSelector?: pulumi.Input<inputs.cilium.v2.CiliumLoadBalancerIPPoolSpecServiceSelectorPatch | undefined>;
         }
         /**
-         * This is a label selector which selects the node that should act as
-         * egress gateway for the given policy.
-         * In case multiple nodes are selected, only the first one in the
-         * lexical ordering over the node names will be used.
-         * This field follows standard label selector semantics.
+         * ServiceSelector selects a set of services which are eligible to receive IPs from this
          */
-        interface CiliumEgressGatewayPolicySpecEgressGatewaysNodeSelector {
+        interface CiliumLoadBalancerIPPoolSpecServiceSelector {
             /**
              * matchExpressions is a list of label selector requirements. The requirements are ANDed.
              */
-            matchExpressions?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumEgressGatewayPolicySpecEgressGatewaysNodeSelectorMatchExpressions>[] | undefined>;
+            matchExpressions?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumLoadBalancerIPPoolSpecServiceSelectorMatchExpressions>[] | undefined>;
             /**
              * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
              * map is equivalent to an element of matchExpressions, whose key field is "key", the
@@ -60078,735 +59659,7 @@ export declare namespace cilium {
          * A label selector requirement is a selector that contains values, a key, and an operator that
          * relates the key and values.
          */
-        interface CiliumEgressGatewayPolicySpecEgressGatewaysNodeSelectorMatchExpressions {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key: pulumi.Input<string>;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator: pulumi.Input<string>;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values?: pulumi.Input<pulumi.Input<string>[] | undefined>;
-        }
-        /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
-         */
-        interface CiliumEgressGatewayPolicySpecEgressGatewaysNodeSelectorMatchExpressionsPatch {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key?: pulumi.Input<string | undefined>;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator?: pulumi.Input<string | undefined>;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values?: pulumi.Input<pulumi.Input<string>[] | undefined>;
-        }
-        /**
-         * This is a label selector which selects the node that should act as
-         * egress gateway for the given policy.
-         * In case multiple nodes are selected, only the first one in the
-         * lexical ordering over the node names will be used.
-         * This field follows standard label selector semantics.
-         */
-        interface CiliumEgressGatewayPolicySpecEgressGatewaysNodeSelectorPatch {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumEgressGatewayPolicySpecEgressGatewaysNodeSelectorMatchExpressionsPatch>[] | undefined>;
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels?: pulumi.Input<{
-                [key: string]: pulumi.Input<string>;
-            } | undefined>;
-        }
-        /**
-         * EgressGateway identifies the node that should act as egress gateway for a
-         * given egress Gateway policy. In addition to that it also specifies the
-         * configuration of said node (which egress IP or network interface should be
-         * used to SNAT traffic).
-         */
-        interface CiliumEgressGatewayPolicySpecEgressGatewaysPatch {
-            /**
-             * EgressIP is the source IP address that the egress traffic is SNATed
-             * with.
-             *
-             * Example:
-             * When set to "192.168.1.100", matching egress traffic will be
-             * redirected to the node matching the NodeSelector field and SNATed
-             * with IP address 192.168.1.100.
-             *
-             * When set to "2001:db8::1", matching egress traffic will be
-             * redirected to the node matching the NodeSelector field and SNATed
-             * with IPv6 address 2001:db8::1.
-             *
-             * When none of the Interface or EgressIP fields is specified, the
-             * policy will use the first IPv4 assigned to the interface with the
-             * default route.
-             */
-            egressIP?: pulumi.Input<string | undefined>;
-            /**
-             * Interface is the network interface to which the egress IP address
-             * that the traffic is SNATed with is assigned.
-             *
-             * Example:
-             * When set to "eth1", matching egress traffic will be redirected to the
-             * node matching the NodeSelector field and SNATed with the first IPv4
-             * address assigned to the eth1 interface.
-             *
-             * When none of the Interface or EgressIP fields is specified, the
-             * policy will use the first IPv4 assigned to the interface with the
-             * default route.
-             */
-            interface?: pulumi.Input<string | undefined>;
-            nodeSelector?: pulumi.Input<inputs.cilium.v2.CiliumEgressGatewayPolicySpecEgressGatewaysNodeSelectorPatch | undefined>;
-        }
-        interface CiliumEgressGatewayPolicySpecPatch {
-            /**
-             * DestinationCIDRs is a list of destination CIDRs for destination IP addresses.
-             * If a destination IP matches any one CIDR, it will be selected.
-             */
-            destinationCIDRs?: pulumi.Input<pulumi.Input<string>[] | undefined>;
-            egressGateway?: pulumi.Input<inputs.cilium.v2.CiliumEgressGatewayPolicySpecEgressGatewayPatch | undefined>;
-            /**
-             * Optional list of gateway nodes responsible for SNATing traffic.
-             * If this field has any entries the contents of the egressGateway field will be ignored.
-             * In case multiple nodes are a match for the given set of labels in each entry,
-             * the first node in lexical ordering based on their name will be selected for each entry.
-             */
-            egressGateways?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumEgressGatewayPolicySpecEgressGatewaysPatch>[] | undefined>;
-            /**
-             * ExcludedCIDRs is a list of destination CIDRs that will be excluded
-             * from the egress gateway redirection and SNAT logic.
-             * Should be a subset of destinationCIDRs otherwise it will not have any
-             * effect.
-             */
-            excludedCIDRs?: pulumi.Input<pulumi.Input<string>[] | undefined>;
-            /**
-             * Egress represents a list of rules by which egress traffic is
-             * filtered from the source pods.
-             */
-            selectors?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumEgressGatewayPolicySpecSelectorsPatch>[] | undefined>;
-        }
-        interface CiliumEgressGatewayPolicySpecSelectors {
-            namespaceSelector?: pulumi.Input<inputs.cilium.v2.CiliumEgressGatewayPolicySpecSelectorsNamespaceSelector | undefined>;
-            nodeSelector?: pulumi.Input<inputs.cilium.v2.CiliumEgressGatewayPolicySpecSelectorsNodeSelector | undefined>;
-            podSelector?: pulumi.Input<inputs.cilium.v2.CiliumEgressGatewayPolicySpecSelectorsPodSelector | undefined>;
-        }
-        /**
-         * Selects Namespaces using cluster-scoped labels. This field follows standard label
-         * selector semantics; if present but empty, it selects all namespaces.
-         */
-        interface CiliumEgressGatewayPolicySpecSelectorsNamespaceSelector {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumEgressGatewayPolicySpecSelectorsNamespaceSelectorMatchExpressions>[] | undefined>;
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels?: pulumi.Input<{
-                [key: string]: pulumi.Input<string>;
-            } | undefined>;
-        }
-        /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
-         */
-        interface CiliumEgressGatewayPolicySpecSelectorsNamespaceSelectorMatchExpressions {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key: pulumi.Input<string>;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator: pulumi.Input<string>;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values?: pulumi.Input<pulumi.Input<string>[] | undefined>;
-        }
-        /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
-         */
-        interface CiliumEgressGatewayPolicySpecSelectorsNamespaceSelectorMatchExpressionsPatch {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key?: pulumi.Input<string | undefined>;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator?: pulumi.Input<string | undefined>;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values?: pulumi.Input<pulumi.Input<string>[] | undefined>;
-        }
-        /**
-         * Selects Namespaces using cluster-scoped labels. This field follows standard label
-         * selector semantics; if present but empty, it selects all namespaces.
-         */
-        interface CiliumEgressGatewayPolicySpecSelectorsNamespaceSelectorPatch {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumEgressGatewayPolicySpecSelectorsNamespaceSelectorMatchExpressionsPatch>[] | undefined>;
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels?: pulumi.Input<{
-                [key: string]: pulumi.Input<string>;
-            } | undefined>;
-        }
-        /**
-         * This is a label selector which selects Pods by Node. This field follows standard label
-         * selector semantics; if present but empty, it selects all nodes.
-         */
-        interface CiliumEgressGatewayPolicySpecSelectorsNodeSelector {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumEgressGatewayPolicySpecSelectorsNodeSelectorMatchExpressions>[] | undefined>;
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels?: pulumi.Input<{
-                [key: string]: pulumi.Input<string>;
-            } | undefined>;
-        }
-        /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
-         */
-        interface CiliumEgressGatewayPolicySpecSelectorsNodeSelectorMatchExpressions {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key: pulumi.Input<string>;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator: pulumi.Input<string>;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values?: pulumi.Input<pulumi.Input<string>[] | undefined>;
-        }
-        /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
-         */
-        interface CiliumEgressGatewayPolicySpecSelectorsNodeSelectorMatchExpressionsPatch {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key?: pulumi.Input<string | undefined>;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator?: pulumi.Input<string | undefined>;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values?: pulumi.Input<pulumi.Input<string>[] | undefined>;
-        }
-        /**
-         * This is a label selector which selects Pods by Node. This field follows standard label
-         * selector semantics; if present but empty, it selects all nodes.
-         */
-        interface CiliumEgressGatewayPolicySpecSelectorsNodeSelectorPatch {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumEgressGatewayPolicySpecSelectorsNodeSelectorMatchExpressionsPatch>[] | undefined>;
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels?: pulumi.Input<{
-                [key: string]: pulumi.Input<string>;
-            } | undefined>;
-        }
-        interface CiliumEgressGatewayPolicySpecSelectorsPatch {
-            namespaceSelector?: pulumi.Input<inputs.cilium.v2.CiliumEgressGatewayPolicySpecSelectorsNamespaceSelectorPatch | undefined>;
-            nodeSelector?: pulumi.Input<inputs.cilium.v2.CiliumEgressGatewayPolicySpecSelectorsNodeSelectorPatch | undefined>;
-            podSelector?: pulumi.Input<inputs.cilium.v2.CiliumEgressGatewayPolicySpecSelectorsPodSelectorPatch | undefined>;
-        }
-        /**
-         * This is a label selector which selects Pods. This field follows standard label
-         * selector semantics; if present but empty, it selects all pods.
-         */
-        interface CiliumEgressGatewayPolicySpecSelectorsPodSelector {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumEgressGatewayPolicySpecSelectorsPodSelectorMatchExpressions>[] | undefined>;
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels?: pulumi.Input<{
-                [key: string]: pulumi.Input<string>;
-            } | undefined>;
-        }
-        /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
-         */
-        interface CiliumEgressGatewayPolicySpecSelectorsPodSelectorMatchExpressions {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key: pulumi.Input<string>;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator: pulumi.Input<string>;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values?: pulumi.Input<pulumi.Input<string>[] | undefined>;
-        }
-        /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
-         */
-        interface CiliumEgressGatewayPolicySpecSelectorsPodSelectorMatchExpressionsPatch {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key?: pulumi.Input<string | undefined>;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator?: pulumi.Input<string | undefined>;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values?: pulumi.Input<pulumi.Input<string>[] | undefined>;
-        }
-        /**
-         * This is a label selector which selects Pods. This field follows standard label
-         * selector semantics; if present but empty, it selects all pods.
-         */
-        interface CiliumEgressGatewayPolicySpecSelectorsPodSelectorPatch {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumEgressGatewayPolicySpecSelectorsPodSelectorMatchExpressionsPatch>[] | undefined>;
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels?: pulumi.Input<{
-                [key: string]: pulumi.Input<string>;
-            } | undefined>;
-        }
-        interface CiliumEnvoyConfig {
-            /**
-             * APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-             */
-            apiVersion?: pulumi.Input<"cilium.io/v2" | undefined>;
-            /**
-             * Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-             */
-            kind?: pulumi.Input<"CiliumEnvoyConfig" | undefined>;
-            /**
-             * Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
-             */
-            metadata: pulumi.Input<pulumiKubernetes.types.input.meta.v1.ObjectMeta>;
-            spec?: pulumi.Input<inputs.cilium.v2.CiliumEnvoyConfigSpec | undefined>;
-        }
-        interface CiliumEnvoyConfigSpec {
-            /**
-             * BackendServices specifies Kubernetes services whose backends
-             * are automatically synced to Envoy using EDS.  Traffic for these
-             * services is not forwarded to an Envoy listener. This allows an
-             * Envoy listener load balance traffic to these backends while
-             * normal Cilium service load balancing takes care of balancing
-             * traffic for these services at the same time.
-             */
-            backendServices?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumEnvoyConfigSpecBackendServices>[] | undefined>;
-            nodeSelector?: pulumi.Input<inputs.cilium.v2.CiliumEnvoyConfigSpecNodeSelector | undefined>;
-            /**
-             * Envoy xDS resources, a list of the following Envoy resource types:
-             * type.googleapis.com/envoy.config.listener.v3.Listener,
-             * type.googleapis.com/envoy.config.route.v3.RouteConfiguration,
-             * type.googleapis.com/envoy.config.cluster.v3.Cluster,
-             * type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment, and
-             * type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret.
-             */
-            resources: pulumi.Input<pulumi.Input<{
-                [key: string]: any;
-            }>[]>;
-            /**
-             * Services specifies Kubernetes services for which traffic is
-             * forwarded to an Envoy listener for L7 load balancing. Backends
-             * of these services are automatically synced to Envoy usign EDS.
-             */
-            services?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumEnvoyConfigSpecServices>[] | undefined>;
-        }
-        interface CiliumEnvoyConfigSpecBackendServices {
-            /**
-             * Name is the name of a destination Kubernetes service that identifies traffic
-             * to be redirected.
-             */
-            name: pulumi.Input<string>;
-            /**
-             * Namespace is the Kubernetes service namespace.
-             * In CiliumEnvoyConfig namespace defaults to the namespace of the CEC,
-             * In CiliumClusterwideEnvoyConfig namespace defaults to "default".
-             */
-            namespace?: pulumi.Input<string | undefined>;
-            /**
-             * Ports is a set of port numbers, which can be used for filtering in case of underlying
-             * is exposing multiple port numbers.
-             */
-            number?: pulumi.Input<pulumi.Input<string>[] | undefined>;
-        }
-        interface CiliumEnvoyConfigSpecBackendServicesPatch {
-            /**
-             * Name is the name of a destination Kubernetes service that identifies traffic
-             * to be redirected.
-             */
-            name?: pulumi.Input<string | undefined>;
-            /**
-             * Namespace is the Kubernetes service namespace.
-             * In CiliumEnvoyConfig namespace defaults to the namespace of the CEC,
-             * In CiliumClusterwideEnvoyConfig namespace defaults to "default".
-             */
-            namespace?: pulumi.Input<string | undefined>;
-            /**
-             * Ports is a set of port numbers, which can be used for filtering in case of underlying
-             * is exposing multiple port numbers.
-             */
-            number?: pulumi.Input<pulumi.Input<string>[] | undefined>;
-        }
-        /**
-         * NodeSelector is a label selector that determines to which nodes
-         * this configuration applies.
-         * If nil, then this config applies to all nodes.
-         */
-        interface CiliumEnvoyConfigSpecNodeSelector {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumEnvoyConfigSpecNodeSelectorMatchExpressions>[] | undefined>;
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels?: pulumi.Input<{
-                [key: string]: pulumi.Input<string>;
-            } | undefined>;
-        }
-        /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
-         */
-        interface CiliumEnvoyConfigSpecNodeSelectorMatchExpressions {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key: pulumi.Input<string>;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator: pulumi.Input<string>;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values?: pulumi.Input<pulumi.Input<string>[] | undefined>;
-        }
-        /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
-         */
-        interface CiliumEnvoyConfigSpecNodeSelectorMatchExpressionsPatch {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key?: pulumi.Input<string | undefined>;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator?: pulumi.Input<string | undefined>;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values?: pulumi.Input<pulumi.Input<string>[] | undefined>;
-        }
-        /**
-         * NodeSelector is a label selector that determines to which nodes
-         * this configuration applies.
-         * If nil, then this config applies to all nodes.
-         */
-        interface CiliumEnvoyConfigSpecNodeSelectorPatch {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumEnvoyConfigSpecNodeSelectorMatchExpressionsPatch>[] | undefined>;
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels?: pulumi.Input<{
-                [key: string]: pulumi.Input<string>;
-            } | undefined>;
-        }
-        interface CiliumEnvoyConfigSpecPatch {
-            /**
-             * BackendServices specifies Kubernetes services whose backends
-             * are automatically synced to Envoy using EDS.  Traffic for these
-             * services is not forwarded to an Envoy listener. This allows an
-             * Envoy listener load balance traffic to these backends while
-             * normal Cilium service load balancing takes care of balancing
-             * traffic for these services at the same time.
-             */
-            backendServices?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumEnvoyConfigSpecBackendServicesPatch>[] | undefined>;
-            nodeSelector?: pulumi.Input<inputs.cilium.v2.CiliumEnvoyConfigSpecNodeSelectorPatch | undefined>;
-            /**
-             * Envoy xDS resources, a list of the following Envoy resource types:
-             * type.googleapis.com/envoy.config.listener.v3.Listener,
-             * type.googleapis.com/envoy.config.route.v3.RouteConfiguration,
-             * type.googleapis.com/envoy.config.cluster.v3.Cluster,
-             * type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment, and
-             * type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret.
-             */
-            resources?: pulumi.Input<pulumi.Input<{
-                [key: string]: any;
-            }>[] | undefined>;
-            /**
-             * Services specifies Kubernetes services for which traffic is
-             * forwarded to an Envoy listener for L7 load balancing. Backends
-             * of these services are automatically synced to Envoy usign EDS.
-             */
-            services?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumEnvoyConfigSpecServicesPatch>[] | undefined>;
-        }
-        interface CiliumEnvoyConfigSpecServices {
-            /**
-             * Listener specifies the name of the Envoy listener the
-             * service traffic is redirected to. The listener must be
-             * specified in the Envoy 'resources' of the same
-             * CiliumEnvoyConfig.
-             *
-             * If omitted, the first listener specified in 'resources' is
-             * used.
-             */
-            listener?: pulumi.Input<string | undefined>;
-            /**
-             * Name is the name of a destination Kubernetes service that identifies traffic
-             * to be redirected.
-             */
-            name: pulumi.Input<string>;
-            /**
-             * Namespace is the Kubernetes service namespace.
-             * In CiliumEnvoyConfig namespace this is overridden to the namespace of the CEC,
-             * In CiliumClusterwideEnvoyConfig namespace defaults to "default".
-             */
-            namespace?: pulumi.Input<string | undefined>;
-            /**
-             * Ports is a set of service's frontend ports that should be redirected to the Envoy
-             * listener. By default all frontend ports of the service are redirected.
-             */
-            ports?: pulumi.Input<pulumi.Input<number>[] | undefined>;
-        }
-        interface CiliumEnvoyConfigSpecServicesPatch {
-            /**
-             * Listener specifies the name of the Envoy listener the
-             * service traffic is redirected to. The listener must be
-             * specified in the Envoy 'resources' of the same
-             * CiliumEnvoyConfig.
-             *
-             * If omitted, the first listener specified in 'resources' is
-             * used.
-             */
-            listener?: pulumi.Input<string | undefined>;
-            /**
-             * Name is the name of a destination Kubernetes service that identifies traffic
-             * to be redirected.
-             */
-            name?: pulumi.Input<string | undefined>;
-            /**
-             * Namespace is the Kubernetes service namespace.
-             * In CiliumEnvoyConfig namespace this is overridden to the namespace of the CEC,
-             * In CiliumClusterwideEnvoyConfig namespace defaults to "default".
-             */
-            namespace?: pulumi.Input<string | undefined>;
-            /**
-             * Ports is a set of service's frontend ports that should be redirected to the Envoy
-             * listener. By default all frontend ports of the service are redirected.
-             */
-            ports?: pulumi.Input<pulumi.Input<number>[] | undefined>;
-        }
-        /**
-         * CiliumLoadBalancerIPPool is a Kubernetes third-party resource which
-         * is used to defined pools of IPs which the operator can use to allocate
-         * and advertise IPs for Services of type LoadBalancer.
-         */
-        interface CiliumLoadBalancerIPPool {
-            /**
-             * APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-             */
-            apiVersion?: pulumi.Input<"cilium.io/v2" | undefined>;
-            /**
-             * Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-             */
-            kind?: pulumi.Input<"CiliumLoadBalancerIPPool" | undefined>;
-            /**
-             * Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
-             */
-            metadata: pulumi.Input<pulumiKubernetes.types.input.meta.v1.ObjectMeta>;
-            spec: pulumi.Input<inputs.cilium.v2.CiliumLoadBalancerIPPoolSpec>;
-            status?: pulumi.Input<inputs.cilium.v2.CiliumLoadBalancerIPPoolStatus | undefined>;
-        }
-        /**
-         * Spec is a human readable description for a BGP load balancer
-         * ip pool.
-         */
-        interface CiliumLoadBalancerIPPoolSpec {
-            /**
-             * AllowFirstLastIPs, if set to `Yes` or undefined means that the first and last IPs of each CIDR will be allocatable.
-             * If `No`, these IPs will be reserved. This field is ignored for /{31,32} and /{127,128} CIDRs since
-             * reserving the first and last IPs would make the CIDRs unusable.
-             */
-            allowFirstLastIPs?: pulumi.Input<string | undefined>;
-            /**
-             * Blocks is a list of CIDRs comprising this IP Pool
-             */
-            blocks?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumLoadBalancerIPPoolSpecBlocks>[] | undefined>;
-            /**
-             * Disabled, if set to true means that no new IPs will be allocated from this pool.
-             * Existing allocations will not be removed from services.
-             */
-            disabled?: pulumi.Input<boolean | undefined>;
-            serviceSelector?: pulumi.Input<inputs.cilium.v2.CiliumLoadBalancerIPPoolSpecServiceSelector | undefined>;
-        }
-        /**
-         * CiliumLoadBalancerIPPoolIPBlock describes a single IP block.
-         */
-        interface CiliumLoadBalancerIPPoolSpecBlocks {
-            cidr?: pulumi.Input<string | undefined>;
-            start?: pulumi.Input<string | undefined>;
-            stop?: pulumi.Input<string | undefined>;
-        }
-        /**
-         * CiliumLoadBalancerIPPoolIPBlock describes a single IP block.
-         */
-        interface CiliumLoadBalancerIPPoolSpecBlocksPatch {
-            cidr?: pulumi.Input<string | undefined>;
-            start?: pulumi.Input<string | undefined>;
-            stop?: pulumi.Input<string | undefined>;
-        }
-        /**
-         * Spec is a human readable description for a BGP load balancer
-         * ip pool.
-         */
-        interface CiliumLoadBalancerIPPoolSpecPatch {
-            /**
-             * AllowFirstLastIPs, if set to `Yes` or undefined means that the first and last IPs of each CIDR will be allocatable.
-             * If `No`, these IPs will be reserved. This field is ignored for /{31,32} and /{127,128} CIDRs since
-             * reserving the first and last IPs would make the CIDRs unusable.
-             */
-            allowFirstLastIPs?: pulumi.Input<string | undefined>;
-            /**
-             * Blocks is a list of CIDRs comprising this IP Pool
-             */
-            blocks?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumLoadBalancerIPPoolSpecBlocksPatch>[] | undefined>;
-            /**
-             * Disabled, if set to true means that no new IPs will be allocated from this pool.
-             * Existing allocations will not be removed from services.
-             */
-            disabled?: pulumi.Input<boolean | undefined>;
-            serviceSelector?: pulumi.Input<inputs.cilium.v2.CiliumLoadBalancerIPPoolSpecServiceSelectorPatch | undefined>;
-        }
-        /**
-         * ServiceSelector selects a set of services which are eligible to receive IPs from this
-         */
-        interface CiliumLoadBalancerIPPoolSpecServiceSelector {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumLoadBalancerIPPoolSpecServiceSelectorMatchExpressions>[] | undefined>;
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels?: pulumi.Input<{
-                [key: string]: pulumi.Input<string>;
-            } | undefined>;
-        }
-        /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
-         */
-        interface CiliumLoadBalancerIPPoolSpecServiceSelectorMatchExpressions {
+        interface CiliumLoadBalancerIPPoolSpecServiceSelectorMatchExpressions {
             /**
              * key is the label key that the selector applies to.
              */
@@ -60913,439 +59766,6 @@ export declare namespace cilium {
              */
             type: pulumi.Input<string>;
         }
-        /**
-         * CiliumLocalRedirectPolicy is a Kubernetes Custom Resource that contains a
-         * specification to redirect traffic locally within a node.
-         */
-        interface CiliumLocalRedirectPolicy {
-            /**
-             * APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-             */
-            apiVersion?: pulumi.Input<"cilium.io/v2" | undefined>;
-            /**
-             * Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-             */
-            kind?: pulumi.Input<"CiliumLocalRedirectPolicy" | undefined>;
-            /**
-             * Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
-             */
-            metadata: pulumi.Input<pulumiKubernetes.types.input.meta.v1.ObjectMeta>;
-            spec?: pulumi.Input<inputs.cilium.v2.CiliumLocalRedirectPolicySpec | undefined>;
-            status?: pulumi.Input<inputs.cilium.v2.CiliumLocalRedirectPolicyStatus | undefined>;
-        }
-        /**
-         * Spec is the desired behavior of the local redirect policy.
-         */
-        interface CiliumLocalRedirectPolicySpec {
-            /**
-             * Description can be used by the creator of the policy to describe the
-             * purpose of this policy.
-             */
-            description?: pulumi.Input<string | undefined>;
-            redirectBackend: pulumi.Input<inputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectBackend>;
-            redirectFrontend: pulumi.Input<inputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectFrontend>;
-            /**
-             * SkipRedirectFromBackend indicates whether traffic matching RedirectFrontend
-             * from RedirectBackend should skip redirection, and hence the traffic will
-             * be forwarded as-is.
-             *
-             * The default is false which means traffic matching RedirectFrontend will
-             * get redirected from all pods, including the RedirectBackend(s).
-             *
-             * Example: If RedirectFrontend is configured to "169.254.169.254:80" as the traffic
-             * that needs to be redirected to backends selected by RedirectBackend, if
-             * SkipRedirectFromBackend is set to true, traffic going to "169.254.169.254:80"
-             * from such backends will not be redirected back to the backends. Instead,
-             * the matched traffic from the backends will be forwarded to the original
-             * destination "169.254.169.254:80".
-             */
-            skipRedirectFromBackend?: pulumi.Input<boolean | undefined>;
-        }
-        /**
-         * Spec is the desired behavior of the local redirect policy.
-         */
-        interface CiliumLocalRedirectPolicySpecPatch {
-            /**
-             * Description can be used by the creator of the policy to describe the
-             * purpose of this policy.
-             */
-            description?: pulumi.Input<string | undefined>;
-            redirectBackend?: pulumi.Input<inputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectBackendPatch | undefined>;
-            redirectFrontend?: pulumi.Input<inputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectFrontendPatch | undefined>;
-            /**
-             * SkipRedirectFromBackend indicates whether traffic matching RedirectFrontend
-             * from RedirectBackend should skip redirection, and hence the traffic will
-             * be forwarded as-is.
-             *
-             * The default is false which means traffic matching RedirectFrontend will
-             * get redirected from all pods, including the RedirectBackend(s).
-             *
-             * Example: If RedirectFrontend is configured to "169.254.169.254:80" as the traffic
-             * that needs to be redirected to backends selected by RedirectBackend, if
-             * SkipRedirectFromBackend is set to true, traffic going to "169.254.169.254:80"
-             * from such backends will not be redirected back to the backends. Instead,
-             * the matched traffic from the backends will be forwarded to the original
-             * destination "169.254.169.254:80".
-             */
-            skipRedirectFromBackend?: pulumi.Input<boolean | undefined>;
-        }
-        /**
-         * RedirectBackend specifies backend configuration to redirect traffic to.
-         * It can not be empty.
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectBackend {
-            localEndpointSelector: pulumi.Input<inputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectBackendLocalEndpointSelector>;
-            /**
-             * ToPorts is a list of L4 ports with protocol of node local pod(s) where traffic
-             * is redirected to.
-             * When multiple ports are specified, the ports must be named.
-             */
-            toPorts: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectBackendToPorts>[]>;
-        }
-        /**
-         * LocalEndpointSelector selects node local pod(s) where traffic is redirected to.
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectBackendLocalEndpointSelector {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectBackendLocalEndpointSelectorMatchExpressions>[] | undefined>;
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels?: pulumi.Input<{
-                [key: string]: pulumi.Input<string>;
-            } | undefined>;
-        }
-        /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectBackendLocalEndpointSelectorMatchExpressions {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key: pulumi.Input<string>;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator: pulumi.Input<string>;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values?: pulumi.Input<pulumi.Input<string>[] | undefined>;
-        }
-        /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectBackendLocalEndpointSelectorMatchExpressionsPatch {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key?: pulumi.Input<string | undefined>;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator?: pulumi.Input<string | undefined>;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values?: pulumi.Input<pulumi.Input<string>[] | undefined>;
-        }
-        /**
-         * LocalEndpointSelector selects node local pod(s) where traffic is redirected to.
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectBackendLocalEndpointSelectorPatch {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectBackendLocalEndpointSelectorMatchExpressionsPatch>[] | undefined>;
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels?: pulumi.Input<{
-                [key: string]: pulumi.Input<string>;
-            } | undefined>;
-        }
-        /**
-         * RedirectBackend specifies backend configuration to redirect traffic to.
-         * It can not be empty.
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectBackendPatch {
-            localEndpointSelector?: pulumi.Input<inputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectBackendLocalEndpointSelectorPatch | undefined>;
-            /**
-             * ToPorts is a list of L4 ports with protocol of node local pod(s) where traffic
-             * is redirected to.
-             * When multiple ports are specified, the ports must be named.
-             */
-            toPorts?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectBackendToPortsPatch>[] | undefined>;
-        }
-        /**
-         * PortInfo specifies L4 port number and name along with the transport protocol
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectBackendToPorts {
-            /**
-             * Name is a port name, which must contain at least one [a-z],
-             * and may also contain [0-9] and '-' anywhere except adjacent to another
-             * '-' or in the beginning or the end.
-             */
-            name?: pulumi.Input<string | undefined>;
-            /**
-             * Port is an L4 port number. The string will be strictly parsed as a single uint16.
-             */
-            port: pulumi.Input<string>;
-            /**
-             * Protocol is the L4 protocol.
-             * Accepted values: "TCP", "UDP"
-             */
-            protocol: pulumi.Input<string>;
-        }
-        /**
-         * PortInfo specifies L4 port number and name along with the transport protocol
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectBackendToPortsPatch {
-            /**
-             * Name is a port name, which must contain at least one [a-z],
-             * and may also contain [0-9] and '-' anywhere except adjacent to another
-             * '-' or in the beginning or the end.
-             */
-            name?: pulumi.Input<string | undefined>;
-            /**
-             * Port is an L4 port number. The string will be strictly parsed as a single uint16.
-             */
-            port?: pulumi.Input<string | undefined>;
-            /**
-             * Protocol is the L4 protocol.
-             * Accepted values: "TCP", "UDP"
-             */
-            protocol?: pulumi.Input<string | undefined>;
-        }
-        /**
-         * RedirectFrontend specifies frontend configuration to redirect traffic from.
-         * It can not be empty.
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectFrontend {
-            addressMatcher?: pulumi.Input<inputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectFrontendAddressMatcher | undefined>;
-            serviceMatcher?: pulumi.Input<inputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectFrontendServiceMatcher | undefined>;
-        }
-        /**
-         * AddressMatcher is a tuple {IP, port, protocol} that matches traffic to be
-         * redirected.
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectFrontendAddressMatcher {
-            /**
-             * IP is a destination ip address for traffic to be redirected.
-             *
-             * Example:
-             * When it is set to "169.254.169.254", traffic destined to
-             * "169.254.169.254" is redirected.
-             */
-            ip: pulumi.Input<string>;
-            /**
-             * ToPorts is a list of destination L4 ports with protocol for traffic
-             * to be redirected.
-             * When multiple ports are specified, the ports must be named.
-             *
-             * Example:
-             * When set to Port: "53" and Protocol: UDP, traffic destined to port '53'
-             * with UDP protocol is redirected.
-             */
-            toPorts: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectFrontendAddressMatcherToPorts>[]>;
-        }
-        /**
-         * AddressMatcher is a tuple {IP, port, protocol} that matches traffic to be
-         * redirected.
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectFrontendAddressMatcherPatch {
-            /**
-             * IP is a destination ip address for traffic to be redirected.
-             *
-             * Example:
-             * When it is set to "169.254.169.254", traffic destined to
-             * "169.254.169.254" is redirected.
-             */
-            ip?: pulumi.Input<string | undefined>;
-            /**
-             * ToPorts is a list of destination L4 ports with protocol for traffic
-             * to be redirected.
-             * When multiple ports are specified, the ports must be named.
-             *
-             * Example:
-             * When set to Port: "53" and Protocol: UDP, traffic destined to port '53'
-             * with UDP protocol is redirected.
-             */
-            toPorts?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectFrontendAddressMatcherToPortsPatch>[] | undefined>;
-        }
-        /**
-         * PortInfo specifies L4 port number and name along with the transport protocol
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectFrontendAddressMatcherToPorts {
-            /**
-             * Name is a port name, which must contain at least one [a-z],
-             * and may also contain [0-9] and '-' anywhere except adjacent to another
-             * '-' or in the beginning or the end.
-             */
-            name?: pulumi.Input<string | undefined>;
-            /**
-             * Port is an L4 port number. The string will be strictly parsed as a single uint16.
-             */
-            port: pulumi.Input<string>;
-            /**
-             * Protocol is the L4 protocol.
-             * Accepted values: "TCP", "UDP"
-             */
-            protocol: pulumi.Input<string>;
-        }
-        /**
-         * PortInfo specifies L4 port number and name along with the transport protocol
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectFrontendAddressMatcherToPortsPatch {
-            /**
-             * Name is a port name, which must contain at least one [a-z],
-             * and may also contain [0-9] and '-' anywhere except adjacent to another
-             * '-' or in the beginning or the end.
-             */
-            name?: pulumi.Input<string | undefined>;
-            /**
-             * Port is an L4 port number. The string will be strictly parsed as a single uint16.
-             */
-            port?: pulumi.Input<string | undefined>;
-            /**
-             * Protocol is the L4 protocol.
-             * Accepted values: "TCP", "UDP"
-             */
-            protocol?: pulumi.Input<string | undefined>;
-        }
-        /**
-         * RedirectFrontend specifies frontend configuration to redirect traffic from.
-         * It can not be empty.
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectFrontendPatch {
-            addressMatcher?: pulumi.Input<inputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectFrontendAddressMatcherPatch | undefined>;
-            serviceMatcher?: pulumi.Input<inputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectFrontendServiceMatcherPatch | undefined>;
-        }
-        /**
-         * ServiceMatcher specifies Kubernetes service and port that matches
-         * traffic to be redirected.
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectFrontendServiceMatcher {
-            /**
-             * Namespace is the Kubernetes service namespace.
-             * The service namespace must match the namespace of the parent Local
-             * Redirect Policy.  For Cluster-wide Local Redirect Policy, this
-             * can be any namespace.
-             */
-            namespace: pulumi.Input<string>;
-            /**
-             * Name is the name of a destination Kubernetes service that identifies traffic
-             * to be redirected.
-             * The service type needs to be ClusterIP.
-             *
-             * Example:
-             * When this field is populated with 'serviceName:myService', all the traffic
-             * destined to the cluster IP of this service at the (specified)
-             * service port(s) will be redirected.
-             */
-            serviceName: pulumi.Input<string>;
-            /**
-             * ToPorts is a list of destination service L4 ports with protocol for
-             * traffic to be redirected. If not specified, traffic for all the service
-             * ports will be redirected.
-             * When multiple ports are specified, the ports must be named.
-             */
-            toPorts?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectFrontendServiceMatcherToPorts>[] | undefined>;
-        }
-        /**
-         * ServiceMatcher specifies Kubernetes service and port that matches
-         * traffic to be redirected.
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectFrontendServiceMatcherPatch {
-            /**
-             * Namespace is the Kubernetes service namespace.
-             * The service namespace must match the namespace of the parent Local
-             * Redirect Policy.  For Cluster-wide Local Redirect Policy, this
-             * can be any namespace.
-             */
-            namespace?: pulumi.Input<string | undefined>;
-            /**
-             * Name is the name of a destination Kubernetes service that identifies traffic
-             * to be redirected.
-             * The service type needs to be ClusterIP.
-             *
-             * Example:
-             * When this field is populated with 'serviceName:myService', all the traffic
-             * destined to the cluster IP of this service at the (specified)
-             * service port(s) will be redirected.
-             */
-            serviceName?: pulumi.Input<string | undefined>;
-            /**
-             * ToPorts is a list of destination service L4 ports with protocol for
-             * traffic to be redirected. If not specified, traffic for all the service
-             * ports will be redirected.
-             * When multiple ports are specified, the ports must be named.
-             */
-            toPorts?: pulumi.Input<pulumi.Input<inputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectFrontendServiceMatcherToPortsPatch>[] | undefined>;
-        }
-        /**
-         * PortInfo specifies L4 port number and name along with the transport protocol
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectFrontendServiceMatcherToPorts {
-            /**
-             * Name is a port name, which must contain at least one [a-z],
-             * and may also contain [0-9] and '-' anywhere except adjacent to another
-             * '-' or in the beginning or the end.
-             */
-            name?: pulumi.Input<string | undefined>;
-            /**
-             * Port is an L4 port number. The string will be strictly parsed as a single uint16.
-             */
-            port: pulumi.Input<string>;
-            /**
-             * Protocol is the L4 protocol.
-             * Accepted values: "TCP", "UDP"
-             */
-            protocol: pulumi.Input<string>;
-        }
-        /**
-         * PortInfo specifies L4 port number and name along with the transport protocol
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectFrontendServiceMatcherToPortsPatch {
-            /**
-             * Name is a port name, which must contain at least one [a-z],
-             * and may also contain [0-9] and '-' anywhere except adjacent to another
-             * '-' or in the beginning or the end.
-             */
-            name?: pulumi.Input<string | undefined>;
-            /**
-             * Port is an L4 port number. The string will be strictly parsed as a single uint16.
-             */
-            port?: pulumi.Input<string | undefined>;
-            /**
-             * Protocol is the L4 protocol.
-             * Accepted values: "TCP", "UDP"
-             */
-            protocol?: pulumi.Input<string | undefined>;
-        }
-        /**
-         * Status is the most recent status of the local redirect policy.
-         * It is a read-only field.
-         */
-        interface CiliumLocalRedirectPolicyStatus {
-            ok?: pulumi.Input<boolean | undefined>;
-        }
         /**
          * CiliumNetworkPolicy is a Kubernetes third-party resource with an extended
          * version of NetworkPolicy.
@@ -75701,8 +74121,123 @@ export declare namespace external_secrets {
          * BarbicanAuth contains the authentication information for Barbican.
          */
         interface ClusterSecretStoreSpecProviderBarbicanAuth {
-            password: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthPassword>;
-            username: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthUsername>;
+            applicationCredentialID?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialID | undefined>;
+            applicationCredentialSecret?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialSecret | undefined>;
+            /**
+             * AuthType selects how Barbican authenticates.
+             * - "password": use username and password.
+             * - "applicationCredential": use application credential ID and secret.
+             *   Defaults to "password".
+             */
+            authType?: pulumi.Input<string | undefined>;
+            password?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthPassword | undefined>;
+            username?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthUsername | undefined>;
+        }
+        /**
+         * ID of the application credential used for authentication.
+         */
+        interface ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialID {
+            secretRef?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialIDSecretRef | undefined>;
+            value?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * ID of the application credential used for authentication.
+         */
+        interface ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialIDPatch {
+            secretRef?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialIDSecretRefPatch | undefined>;
+            value?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * SecretKeySelector is a reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialIDSecretRef {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string | undefined>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * SecretKeySelector is a reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialIDSecretRefPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string | undefined>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * BarbicanProviderAppCredSecretRef defines a reference to an Application Credential Secret.
+         */
+        interface ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialSecret {
+            secretRef: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialSecretSecretRef>;
+        }
+        /**
+         * BarbicanProviderAppCredSecretRef defines a reference to an Application Credential Secret.
+         */
+        interface ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialSecretPatch {
+            secretRef?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialSecretSecretRefPatch | undefined>;
+        }
+        /**
+         * SecretKeySelector is a reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialSecretSecretRef {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string | undefined>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * SecretKeySelector is a reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialSecretSecretRefPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string | undefined>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
         }
         /**
          * BarbicanProviderPasswordRef defines a reference to a secret containing password for the Barbican provider.
@@ -75760,18 +74295,27 @@ export declare namespace external_secrets {
          * BarbicanAuth contains the authentication information for Barbican.
          */
         interface ClusterSecretStoreSpecProviderBarbicanAuthPatch {
+            applicationCredentialID?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialIDPatch | undefined>;
+            applicationCredentialSecret?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialSecretPatch | undefined>;
+            /**
+             * AuthType selects how Barbican authenticates.
+             * - "password": use username and password.
+             * - "applicationCredential": use application credential ID and secret.
+             *   Defaults to "password".
+             */
+            authType?: pulumi.Input<string | undefined>;
             password?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthPasswordPatch | undefined>;
             username?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthUsernamePatch | undefined>;
         }
         /**
-         * BarbicanProviderUsernameRef defines a reference to a secret containing username for the Barbican provider.
+         * Username / Password authentication fields.
          */
         interface ClusterSecretStoreSpecProviderBarbicanAuthUsername {
             secretRef?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthUsernameSecretRef | undefined>;
             value?: pulumi.Input<string | undefined>;
         }
         /**
-         * BarbicanProviderUsernameRef defines a reference to a secret containing username for the Barbican provider.
+         * Username / Password authentication fields.
          */
         interface ClusterSecretStoreSpecProviderBarbicanAuthUsernamePatch {
             secretRef?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthUsernameSecretRefPatch | undefined>;
@@ -80322,7 +78866,7 @@ export declare namespace external_secrets {
          */
         interface ClusterSecretStoreSpecProviderKeepersecurity {
             authRef: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderKeepersecurityAuthRef>;
-            folderID: pulumi.Input<string>;
+            folderID?: pulumi.Input<string | undefined>;
             getByTitleFallback?: pulumi.Input<boolean | undefined>;
         }
         /**
@@ -88443,8 +86987,123 @@ export declare namespace external_secrets {
          * BarbicanAuth contains the authentication information for Barbican.
          */
         interface SecretStoreSpecProviderBarbicanAuth {
-            password: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthPassword>;
-            username: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthUsername>;
+            applicationCredentialID?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthApplicationCredentialID | undefined>;
+            applicationCredentialSecret?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthApplicationCredentialSecret | undefined>;
+            /**
+             * AuthType selects how Barbican authenticates.
+             * - "password": use username and password.
+             * - "applicationCredential": use application credential ID and secret.
+             *   Defaults to "password".
+             */
+            authType?: pulumi.Input<string | undefined>;
+            password?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthPassword | undefined>;
+            username?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthUsername | undefined>;
+        }
+        /**
+         * ID of the application credential used for authentication.
+         */
+        interface SecretStoreSpecProviderBarbicanAuthApplicationCredentialID {
+            secretRef?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthApplicationCredentialIDSecretRef | undefined>;
+            value?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * ID of the application credential used for authentication.
+         */
+        interface SecretStoreSpecProviderBarbicanAuthApplicationCredentialIDPatch {
+            secretRef?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthApplicationCredentialIDSecretRefPatch | undefined>;
+            value?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * SecretKeySelector is a reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface SecretStoreSpecProviderBarbicanAuthApplicationCredentialIDSecretRef {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string | undefined>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * SecretKeySelector is a reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface SecretStoreSpecProviderBarbicanAuthApplicationCredentialIDSecretRefPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string | undefined>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * BarbicanProviderAppCredSecretRef defines a reference to an Application Credential Secret.
+         */
+        interface SecretStoreSpecProviderBarbicanAuthApplicationCredentialSecret {
+            secretRef: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthApplicationCredentialSecretSecretRef>;
+        }
+        /**
+         * BarbicanProviderAppCredSecretRef defines a reference to an Application Credential Secret.
+         */
+        interface SecretStoreSpecProviderBarbicanAuthApplicationCredentialSecretPatch {
+            secretRef?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthApplicationCredentialSecretSecretRefPatch | undefined>;
+        }
+        /**
+         * SecretKeySelector is a reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface SecretStoreSpecProviderBarbicanAuthApplicationCredentialSecretSecretRef {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string | undefined>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * SecretKeySelector is a reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface SecretStoreSpecProviderBarbicanAuthApplicationCredentialSecretSecretRefPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string | undefined>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
         }
         /**
          * BarbicanProviderPasswordRef defines a reference to a secret containing password for the Barbican provider.
@@ -88502,18 +87161,27 @@ export declare namespace external_secrets {
          * BarbicanAuth contains the authentication information for Barbican.
          */
         interface SecretStoreSpecProviderBarbicanAuthPatch {
+            applicationCredentialID?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthApplicationCredentialIDPatch | undefined>;
+            applicationCredentialSecret?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthApplicationCredentialSecretPatch | undefined>;
+            /**
+             * AuthType selects how Barbican authenticates.
+             * - "password": use username and password.
+             * - "applicationCredential": use application credential ID and secret.
+             *   Defaults to "password".
+             */
+            authType?: pulumi.Input<string | undefined>;
             password?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthPasswordPatch | undefined>;
             username?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthUsernamePatch | undefined>;
         }
         /**
-         * BarbicanProviderUsernameRef defines a reference to a secret containing username for the Barbican provider.
+         * Username / Password authentication fields.
          */
         interface SecretStoreSpecProviderBarbicanAuthUsername {
             secretRef?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthUsernameSecretRef | undefined>;
             value?: pulumi.Input<string | undefined>;
         }
         /**
-         * BarbicanProviderUsernameRef defines a reference to a secret containing username for the Barbican provider.
+         * Username / Password authentication fields.
          */
         interface SecretStoreSpecProviderBarbicanAuthUsernamePatch {
             secretRef?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthUsernameSecretRefPatch | undefined>;
@@ -93064,7 +91732,7 @@ export declare namespace external_secrets {
          */
         interface SecretStoreSpecProviderKeepersecurity {
             authRef: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderKeepersecurityAuthRef>;
-            folderID: pulumi.Input<string>;
+            folderID?: pulumi.Input<string | undefined>;
             getByTitleFallback?: pulumi.Input<boolean | undefined>;
         }
         /**